OpenAI’s Hugging Face Hack Debrief Raises More Questions Than It Answers

OpenAI published the most complete report to date on Wednesday about what happened when its AI agents hacked into Hugging Face last month. For the most part, though, the 37-page document raises more questions than it answers, including about what preceded the incident and how OpenAI can stop another one like it from happening again.

What remains especially perplexing is why one of the world’s preeminent AI development labs seemingly underestimated its own models’ capabilities. OpenAI has spent years warning the world about the rapid advancement of AI systems. And yet it failed to implement long-established network security and isolation measures that may have prevented the hacking spree.

“With the benefit of hindsight, some early signals identified in this report could have triggered an earlier response,” OpenAI says in the postmortem.

In the report, OpenAI shared new details about how a set of AI agents escaped the company’s internal evaluation environments, left messages for one another in the crevices of its software infrastructure over several months, and coordinated to hack the AI platform Hugging Face—all in a wild quest to complete a cybersecurity assessment. OpenAI previously shared some information about the breach in blog posts and a talk at the Black Hat cybersecurity conference.

Hugging Face initially disclosed the incident on July 16 without naming the culprit; five days later, OpenAI acknowledged that its own agents were responsible. The revelation sparked a broader reckoning across the industry, which has recently found that AI models from Anthropic, Meta, and the Chinese AI startup Moonshot were involved in similar episodes.

OpenAI’s postmortem has been eagerly awaited by AI researchers and policymakers hoping to prevent AI agents from causing similar kinds of real-world harm. After the Hugging Face hack was first disclosed, attorneys general from 15 states sent a letter to OpenAI asking it to preserve evidence about it. And this week, Alabama’s attorney general subpoenaed the company for information related to the episode.

OpenAI says the Hugging Face saga represents a watershed moment for both the company and the broader AI industry. WIRED previously reported that it prompted OpenAI to reevaluate its internal safety culture, and the company said last week it has paused some AI training workloads while it invests more heavily in safety, security, and alignment protocols. “As frontier models become more capable, the safeguards used to contain and monitor them must evolve as well,” OpenAI wrote in the postmortem.

Watching the Watchers

Months before the Hugging Face hack, OpenAI says, employees noticed that its agents had created a covert message board in the package manager Artifactory, which they would later use to coordinate their attack. Around May 26, OpenAI says in the postmortem, “an internal team observed an agent engage in message board activity.” Then, on June 27, OpenAI responders found that a different security incident was linked to the “improvised message board” in Artifactory.

While it’s clear some employees at OpenAI were aware of the message board, the discovery apparently wasn’t escalated to the appropriate safety and security leaders. The AI lab says that on July 6, just days before its agents began using it to organize their attack on Hugging Face, “leaders responsible for incident detection and response” were unaware of its existence, let alone what it signified.